The vulnerability is an out‑of‑bounds read in the Windows IKE Extension that permits an attacker with authorized access to read memory contents and expose sensitive data over the network. The flaw falls under CWE‑125 and, if exploited, allows the disclosure of configuration or cryptographic material without executing code or escalating privileges.

Microsoft Windows 10 releases from version 1607 through 22H2, Microsoft Windows 11 releases 23H2, 24H2, 25H2, 26H2 and 26H1, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025. All architectures listed in the CPE strings are affected.

With a CVSS score of 6.5 the vulnerability carries a medium severity designation. The EPSS score is not available, so current exploitation probability remains unknown, and the issue is not listed in the CISA KEV catalog, indicating no widespread known exploitation. The likely attack vector is remote, leveraging the IKE protocol over ports 500 or 4500, and does not require elevated privileges beyond those granted to the IKE service. The risk is thus confined mainly to sensitive data exposure rather than code execution.